Netty: Seven Vulnerabilities Disclosed Together Affecting Protocol Handling and Data Parsing
A batch of seven vulnerabilities affecting Netty's network application framework was disclosed on July 23, 2026, impacting various components and versions.
Key findings
- Seven vulnerabilities disclosed in Netty on July 23, 2026, affecting multiple components.
- Issues range from replay attacks and denial-of-service to information leaks and security control bypasses.
- Vulnerabilities impact Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final.
- Patches are available in Netty 4.2.16.Final and 4.1.135.Final.
- Specific flaws found in SPDY, HTTP/3, OCSP, XML parsing, HAProxy, and CORS handling.
On July 23, 2026, a batch of seven vulnerabilities was disclosed in the Netty network application framework. These vulnerabilities, affecting versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, span various components and introduce risks including replay attacks, denial-of-service, and information leaks. The disclosures highlight potential weaknesses in how Netty handles specific network protocols and data parsing.
Several vulnerabilities stem from improper handling of network protocols and data buffers. CVE-2026-56745 describes an issue in the SpdyHttpDecoder where an allocated pooled ByteBuf can be mishandled during processing of client-initiated SYN_STREAM frames. Similarly, CVE-2026-56819 details a potential leak of ByteBuf instances in applications enabling HTTP/2 content decompression, triggered by remote unauthenticated peers sending DATA frames. CVE-2026-56816 points to a flaw in Http3FrameCodec where unlimted buffering of HTTP/3 reserved frame types could be exploited by an attacker.
Other vulnerabilities touch upon data validation and parsing. CVE-2026-56820, affecting OcspClient, fails to validate CertificateID in OCSP responses, opening the door for replay attacks. CVE-2026-56817 involves XmlDecoder and AsyncXmlInput, where an attacker can send XML with a DOCTYPE declaration, potentially leading to XML External Entity (XXE) processing. The HAProxyMessageDecoder in the codec-haproxy module is affected by CVE-2026-55851, which involves incorrect protocol version detection. Lastly, CVE-2026-56746 highlights a security control bypass in CorsHandler during origin evaluation, despite a shortCircuit() configuration.
The affected versions for most of these vulnerabilities are Netty 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. The fixes are available in Netty versions 4.2.16.Final and 4.1.135.Final. Users are strongly advised to update to these patched versions to mitigate the identified risks.
This coordinated disclosure of seven vulnerabilities underscores the importance of keeping the Netty framework updated. The variety of issues, from protocol handling to data validation, indicates a broad need for vigilance among developers relying on Netty for their network applications. Staying current with patches is crucial for maintaining the security and integrity of services built upon this framework.